ci: Enable cri-containerd-tests for arm64

This change enables cri-containerd-test for arm64.

Signed-off-by: Seunguk Shin <seunguk.shin@arm.com>
Reviewed-by: Nick Connolly <nick.connolly@arm.com>

.github/workflows/ci.yaml

@@ -333,3 +333,12 @@ jobs:
       tarball-suffix: -${{ inputs.tag }}
       commit-hash: ${{ inputs.commit-hash }}
       target-branch: ${{ inputs.target-branch }}
+
+  run-cri-containerd-tests-arm64:
+    if: ${{ inputs.skip-test != 'yes' }}
+    needs: build-kata-static-tarball-arm64
+    uses: ./.github/workflows/run-cri-containerd-tests-arm64.yaml
+    with:
+      tarball-suffix: -${{ inputs.tag }}
+      commit-hash: ${{ inputs.commit-hash }}
+      target-branch: ${{ inputs.target-branch }}

.github/workflows/run-cri-containerd-tests-arm64.yaml

@@ -0,0 +1,70 @@
+name: CI | Run cri-containerd tests
+on:
+  workflow_call:
+    inputs:
+      tarball-suffix:
+        required: false
+        type: string
+      commit-hash:
+        required: false
+        type: string
+      target-branch:
+        required: false
+        type: string
+        default: ""
+
+jobs:
+  run-cri-containerd:
+    strategy:
+      fail-fast: false
+      matrix:
+        containerd_version: ['active']
+        vmm: ['qemu']
+    runs-on: arm64-non-k8s
+    env:
+      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
+      GOPATH: ${{ github.workspace }}
+      KATA_HYPERVISOR: ${{ matrix.vmm }}
+    steps:
+      - name: Clean up workspace
+        run: |
+          if [ -z "${GITHUB_WORKSPACE}" ]; then
+            echo "ERROR: GITHUB_WORKSPACE is not set"
+            exit 1
+          fi
+
+          workspace_dir=$(sudo realpath "$GITHUB_WORKSPACE")
+          runner_base_dir=/home/github-runner/actions-runner/_work
+
+          if [[ $workspace_dir == $runner_base_dir* ]]; then
+            sudo find $GITHUB_WORKSPACE -mindepth 1 -delete
+          else
+            echo "ERROR: GITHUB_WORKSPACE ($GITHUB_WORKSPACE) must be within $runner_base_dir"
+            exit 1
+          fi
+
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.commit-hash }}
+          fetch-depth: 0
+
+      - name: Rebase atop of the latest target branch
+        run: |
+          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
+        env:
+          TARGET_BRANCH: ${{ inputs.target-branch }}
+
+      - name: Install dependencies
+        run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies
+
+      - name: get-kata-tarball
+        uses: actions/download-artifact@v4
+        with:
+          name: kata-static-tarball-arm64${{ inputs.tarball-suffix }}
+          path: kata-artifacts
+
+      - name: Install kata
+        run: bash tests/integration/cri-containerd/gha-run.sh install-kata kata-artifacts
+
+      - name: Run cri-containerd tests
+        run: bash tests/integration/cri-containerd/gha-run.sh run

tests/integration/cri-containerd/gha-run.sh

@@ -16,9 +16,17 @@ source "${cri_containerd_dir}/../../common.bash"
 function install_dependencies() {
 	info "Installing the dependencies needed for running the cri-containerd tests"
 
+	# Remove go if it's installed as it conflicts with another version of go
+	sudo apt-get remove -y golang-* || true
+	sudo rm -rf /usr/local/go
+
 	# Remove Docker if it's installed as it conflicts with podman-docker
 	sudo apt-get remove -y docker-ce-cli || true
 
+	# Remove containerd if it's installed as it conflicts with another version of containerd
+	sudo apt-get remove -y containerd || true
+	sudo rm -rf /etc/systemd/system/containerd.service
+
 	# Dependency list of projects that we can rely on the system packages
 	# - build-essential
 	#   - Theoretically we only need `make`, but doesn't hurt to install

tests/integration/cri-containerd/integration-tests.sh

@@ -32,7 +32,7 @@ SANDBOXER=${SANDBOXER:-"podsandbox"}
 
 containerd_runtime_type="io.containerd.kata-${KATA_HYPERVISOR}.v2"
 
-containerd_shim_path="$(command -v containerd-shim)"
+containerd_shim_path="$(command -v containerd-shim || true)"
 
 #containerd config file
 readonly tmp_dir=$(mktemp -t -d test-cri-containerd.XXXX)
@@ -101,27 +101,36 @@ function create_containerd_config() {
 		runtime_config_path=""
 		runtime_binary_path=""
 	fi
+
+	# check containerd config version
+	if containerd config default | grep -q "version = 3\>"; then
+		pluginid=\"io.containerd.cri.v1.runtime\"
+	else
+		pluginid="cri"
+	fi
 	info "Kata Config Path ${runtime_config_path}, Runtime Binary Name ${runtime_binary_path}"
 
 cat << EOF | sudo tee "${CONTAINERD_CONFIG_FILE}"
 [debug]
   level = "debug"
 [plugins]
-  [plugins.cri]
-    [plugins.cri.containerd]
+  [plugins.${pluginid}]
+    [plugins.${pluginid}.containerd]
         default_runtime_name = "$runtime"
-      [plugins.cri.containerd.runtimes.${runtime}]
+      [plugins.${pluginid}.containerd.runtimes.${runtime}]
         runtime_type = "${runtime_type}"
         sandboxer = "${SANDBOXER}"
         $( [ $kata_annotations -eq 1 ] && \
         echo 'pod_annotations = ["io.katacontainers.*"]' && \
         echo '        container_annotations = ["io.katacontainers.*"]'
         )
-        [plugins.cri.containerd.runtimes.${runtime}.options]
+        [plugins.${pluginid}.containerd.runtimes.${runtime}.options]
           ConfigPath = "${runtime_config_path}"
           BinaryName = "${runtime_binary_path}"
-[plugins.linux]
-       shim = "${containerd_shim_path}"
+$( [ -n "$containerd_shim_path" ] && \
+echo "[plugins.linux]" && \
+echo "  shim = \"${containerd_shim_path}\""
+)
 EOF
 }
 
@@ -257,6 +266,10 @@ function TestContainerMemoryUpdate() {
 		info "TestContainerMemoryUpdate skipped for qemu with runtime-rs"
 		info "Please check out https://github.com/kata-containers/kata-containers/issues/9375"
 		return
+	elif [[ "${ARCH}" == "aarch64" ]]; then
+		# Currently, arm64 does not support memory hot unplug, just test increasing memory.
+		DoContainerMemoryUpdate 0
+		return
 	elif [[ "${KATA_HYPERVISOR}" != "qemu" ]] || [[ "${ARCH}" == "ppc64le" ]] || [[ "${ARCH}" == "s390x" ]]; then
 		return
 	fi
@@ -601,6 +614,17 @@ function TestDeviceCgroup() {
 
 function main() {
 
+	info "Clean up containers and pods"
+	restart_containerd_service
+	containers=( $(sudo crictl ps --all -o json | jq -r '.containers[].id') )
+	for c in "${containers[@]}"; do
+		sudo crictl rm -f $c
+	done
+	pods=( $(sudo crictl pods -o json | jq -r '.items[].id') )
+	for p in "${pods[@]}"; do
+		sudo crictl rmp -f $p
+	done
+
 	info "Stop crio service"
 	systemctl is-active --quiet crio && sudo systemctl stop crio